Consent with a purpose, and a receipt
A consent record helps later only if it says what it was for, until when and what the person was shown. Essence grants now carry a purpose, a fixed end, a legal basis where declared, and that context.
Months after a person agrees to share something, a question comes up. What exactly did they agree to? For how long, on what legal ground, and what were they told at the time? A record that says only "yes" answers none of it, and the person is left with least to point to.
Our October release made the consent record on the Essence platform answer more of those questions.
Purpose and legal ground
Every consent grant on the platform names its purpose. Since our August release, a grant can also record its legal basis under Article 6 of the GDPR. The basis is fixed when the grant is made and never rewritten. A grant made without one carries none.
The legal basis decides what withdrawal means. Withdrawing always stops Essence giving the organisation anything more. Whether the organisation must also stop using what it already holds depends on the ground the sharing rested on. If it rested on consent, processing must stop. If it rested on a legal obligation or a public task, the organisation may carry on under its own authority, and which of the person's other rights apply, such as objecting, depends on that ground. Where no ground was recorded, the platform says it cannot tell, rather than guess.
Consent for something that does not exist yet
Most consent on the platform covers something concrete: a document or a set of fields in a person's vault, shared with an organisation. Some processes need consent before there is anything to share.
Say a graduate asks their former university to reissue a transcript. The transcript does not exist yet, but the university still needs the graduate's consent to act. A purpose-scoped consent grant covers this. It records that a named organisation may act for one purpose, on one subject, until a set date. It holds identifiers, the purpose, a reference the organisation issued, dates and any words the person chose to add. It holds no record content, no title and no name.
Three limits are built into it. The purpose must come from a closed list, and a purpose joins the list only when a real process needs consent ahead of a document; today the list holds one, reissuing an education transcript. The grant must end no more than 366 days after it is given, so an organisation cannot rely on a consent given years earlier for a different occasion. And only the person who gave it can withdraw it. The platform takes the person from their own sign-in, never from anything the organisation sends.
What the person was shown
When a person consents to a statutory filing or a share, our web form shows them what they are agreeing to. Some of these flows put fields into a public record, such as a filing with a public register, and the form asks the person to acknowledge that before they continue.
The grant now keeps that moment as its receipt context: which flow the person was in, what kind of filing or share it was, which field names become a public record, whether the person acknowledged it and, where the flow needs it, how strongly their identity had been checked. It holds field names and flags, never field values. It is fixed when the grant is created, so if the person's identity is checked more strongly later, the grant still shows what was true when they agreed.
Who can see the record
The server returns a receipt view of a grant to either party, the person or the organisation. Anyone else asking for it gets the same answer as for a grant that does not exist: not found.
A person can also read the history of a share: when it was granted, each time it was used and when it was withdrawn. When a consent for regulated data is withdrawn or expires, the platform seals a snapshot of it at that moment and fingerprints it with SHA-256, so a version produced later would not match.
What this means for you
For a person, a consent with a named purpose and a fixed end is easier to understand and easier to stop. For an organisation, a consent that carries its purpose, its legal ground where one was declared, and what the person was shown helps you evidence the basis on which you acted. If you are designing a process that depends on consent, we would be glad to show you how these pieces fit together.
Published 6 October 2026